Pivot Demonstration Configuration Procedure

Transcription

1 Pivot Demonstration Configuration Procedure This procedure provides a detailed description of the steps needed to test, verify, and demonstrate the CorreLog Pivot Report interface, which parses and normalizes message data from HTTP servers, VPN servers, and other data sources. This procedure requires CorreLog Version or higher to execute. The latest version of CorreLog is available from the following location:

2 1. Create an ODBC System DSN in the Control Panel > Administrative Tools a. Log into the Windows platform as an administrator. b. Click on the "Administrative Tools" folder in the Windows "Control Panel". c. Select "Data Sources (ODBC)" and create a "System DSN" for the relational database. Note: The user can select an arbitrary name for the database. The database name should have English only characters For assistance, click the "Help" button for Microsoft Help on creating an ODC data source for the Windows platform. CorreLog, Inc. Page 2 11/18/2010

3 2. Configure the ODBC Interface at the CorreLog Web Interface a. Log into CorreLog, and select the "Reports > ODBC tab. b. Select the ODBC source created above. c. Click the "Edit" button to edit the ODBC data. d. Supply the parameters as shown below. e. Save the data. Note: The user should specify the same user name, password, and database as created in the first step. The values may require all English characters. The "Use as Default DSN" can be set to "Yes" or "No", and is arbitrary. If the program cannot connect to the ODBC database, a message will be displayed. CorreLog, Inc. Page 3 11/18/2010

4 3. Create a Thread that will collect messages. a. Click on the "Correlation > Threads" screen. b. Click the "AddNew" button to create a new thread that will collect the messages to be displayed in the Pivot Report. c. Supply a "Correlation Thread Title" for the Thread, and "Match Expression". (Both of these items can be in double-byte characters.) The Correlation Thread title should describe the types of messages contained in the thread. d. Click "Save" to save the thread. CorreLog, Inc. Page 4 11/18/2010

5 4. Regenerate the Thread Data a. Click on the Thread hyperlink to view the Thread Messages b. Click the "Regenerate Catalog Information" hyperlink. c. Click the "Generate" button to launch the background process. d. Wait for the Catalog to regenerate. e. Click on the Thread hyperlink, and verify that the catalog now contains messages. (If no messages exist, adjust the "Match Expression" in the previous screen and perform this step again.) Note: This step is optional, and is necessary only to populate the catalog with initial data. This step causes CorreLog to read the all messages that have already occurred, and then load the matching messages into the catalog. (Any new messages that are received will be entered into the catalog without this step.) CorreLog, Inc. Page 5 11/18/2010

6 5. Create a "Pivot" Report. a. Click the "Reports > Pivot" tab to display the Pivot screen. b. Click "AddNew' to add a new Pivot report. c. Select the Thread created above as the "Pivot Report Data Source" d. Provide a title for the Thread. e. Select the ODBC data source created in step 1 and 2 above. f. Select the name of the ODBC table, which is an arbitrary table name. (The name must be in English characters.) g. Click "Save" to save the new Pivot Report. Note: you can also select the number of days, and maximum number of records. The actual report fields will be configured in the next step of the procedure. CorreLog, Inc. Page 6 11/18/2010

7 6. Select the Database Message Fields And Columns a. Select the "Edit #NN" button of the Pivot report, created above. b. On the edit screen, select the "Config" button to display the list of fields. c. Select delimiters for the message, and click the "Sample" button (if needed) to display the message. d. Next to each field of the displayed message, provide an ENGLISH name for the field to be entered into the database. e. Click "Continue" to save the field specifications and return to the Edit screen. f. Click "Save" to save the Pivot Report. Note: Each "Field Name" will be the name of the database column. This value can normally be in either Chinese or English, however the ODBC interface requires that the name is in Chinese only. CorreLog, Inc. Page 7 11/18/2010

8 7. Generate the "Pivot" report. a. On the top level screen, click the "Generate" button and confirm. b. Wait for the reports to finish generation. c. After reports are finished, click the hyperlinks (defined in the previous steps, to view the various message fields, values, and messages. d. Click the "View Database Debug Log" hyperlink at the bottom of the screen to display any errors associated with the database update. Note: If the data does not look correct, try different delimiters or match patterns on the "Edit" screen, repeating the previous step. The errors in the "Database Debug Log" may be in Chinese, English, or a combination. Chinese errors may appear garbled. CorreLog, Inc. Page 8 11/18/2010

9 8. Verify that the table is correctly generated. a. Click the "Reports / ODBC tab to display the ODBC query screen. b. Issue the following command, where (tablename) is the name of the table defined in step 5 above. Select * from (tablename) c. Verify that the data is correctly displayed, such as shown below. Note: The data (including both English and Chinese characters) will be displayed. Each column name will be the field name entered in Step 6, with a "co_" prefix. First four columns of the table (Message Time, Address, Facility, Severity) are automatically added to the database. The table is dropped and recreated each time the report runs. CorreLog, Inc. Page 9 11/18/2010